@czottmann/pi-automode 1.13.0 → 1.15.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project are documented in this file.
 
+## [Unreleased]
+
+## [1.15.0] - 2026-08-28
+
+## Bug fixes
+
+- **OMP 18 classifier compatibility** — Support OMP 18 model registries that lack `complete()` and `getProvider()`. Load the legacy completion API only for these registries. Keep current Pi on its runtime registry path so extension-registered providers remain available. Thanks, @NarryG! (#29)
+
+## [1.14.0] - 2026-08-27
+
+## Bug fixes
+
+- **Classifier stream timeout** — Apply `classifierTimeoutMs` to the full response stream. Provider behavior cannot keep classifier calls pending after the deadline. Parent cancellation remains active. Reject values above the Node.js timer limit. (#30)
+- **OS temp-directory deletes** — Stop hard-denying recursive-delete subtrees under `os.tmpdir()` and `/tmp`. On macOS these resolve into `/private/tmp` and `/private/var/folders`, which matched the `/private` system root and blocked every temp cleanup. Deleting a temp root itself stays blocked. (#31)
+- **Validated temp-root declarations** — Derive the exempt temp roots only from launcher-declared values that stay safe: reject values such as `/`, empty strings, aliases of `HOME`, `/`, or a system root, and ancestors of `HOME`. Without validation, a malformed `TMPDIR` could disable deterministic denials for protected targets, and a broad `permissions.allow` rule could then allow the action without classifier review. Recompute candidates when the effective tmpdir changes. (#31)
+
 ## [1.13.0] - 2026-08-25
 
 ## New features
@@ -35,5 +51,8 @@ All notable changes to this project are documented in this file.
 - **Project config trust gate** — Ignore `.pi/automode.local.json` and `.pi/automode.json` until Pi trusts the project. Apply the trust gate during startup and config reloads. (#16)
 - **In-memory observability logs** — Write logs to an extension-owned directory (`~/.pi/agent/extensions/pi-automode/logs/`) instead of the launching project directory. Thanks, @HerbertGao! (#13)
 
+[Unreleased]: https://github.com/czottmann/pi-automode/compare/v1.15.0...HEAD
+[1.15.0]: https://github.com/czottmann/pi-automode/compare/v1.14.0...v1.15.0
+[1.14.0]: https://github.com/czottmann/pi-automode/compare/v1.13.0...v1.14.0
 [1.13.0]: https://github.com/czottmann/pi-automode/compare/v1.12.0...v1.13.0
 [1.12.0]: https://github.com/czottmann/pi-automode/compare/v1.11.0...v1.12.0

package/README.md

@@ -8,6 +8,10 @@ It is not a sandbox. Extensions run in the Pi process. A malicious extension can
 
 Pi-automode does not guard user `!` or `!!` shell commands. It guards only agent tool calls. Use it to reduce unsafe autonomous tool use. Do not use it as an OS security boundary.
 
+## Compatibility
+
+Pi-automode supports Pi and Oh My Pi (OMP) 18. It automatically uses OMP's legacy completion API. The integration needs no OMP-specific configuration.
+
 ## Install
 
 From npm:
@@ -101,7 +105,7 @@ The extension blocks these before any allow or classifier decision:
 - SSH `authorized_keys` writes
 - cron, launch agent, and system service persistence
 - TLS/certificate/auth weakening patterns
-- root, home, and system-path destructive deletes
+- root, home, and system-path destructive deletes. Subtrees of validated launcher-declared temp directories are treated as disposable. Declared roots that alias `HOME`, `/`, or a system root, or that contain `HOME`, are rejected instead.
 - edits to `.pi/automode*`, `.pi` auto-mode files, and this extension's safety-control files
 
 After these checks, pi-automode applies `permissions.allow`. Protected `write` and `edit` targets continue to the classifier.

package/extensions/auto-mode/classifier.ts

@@ -84,10 +84,9 @@ async function resolveClassifier(
     };
   }
 
-  const rawComplete: ClassifierCompletionFn = (callModel, context, options) =>
-    ctx.modelRegistry.complete(callModel, context, options);
-  const simpleComplete: ClassifierCompletionFn = (callModel, context, options) =>
-    completeSimpleWithRegistry(ctx, callModel, context, options);
+  const { rawComplete, simpleComplete } = createRegistryCompletionFns(
+    ctx.modelRegistry,
+  );
   const completionPlan = createClassifierCompletionPlan(
     model,
     config.classifierReasoningLevel,
@@ -125,6 +124,70 @@ export type ClassifierCompletionFn = (
   },
 ) => Promise<AssistantMessage>;
 
+type RegistryCompletionApi = {
+  complete?: ClassifierCompletionFn;
+  getProvider?: (provider: string) => {
+    streamSimple: (
+      model: Model<any>,
+      context: { systemPrompt: string; messages: UserMessage[] },
+      options: Parameters<ClassifierCompletionFn>[2],
+    ) => { result: () => Promise<AssistantMessage> };
+  } | undefined;
+};
+type ClassifierCompletionFallbacks = {
+  rawComplete: ClassifierCompletionFn;
+  simpleComplete: ClassifierCompletionFn;
+};
+
+type ClassifierCompletionFallbackLoader =
+  () => Promise<ClassifierCompletionFallbacks>;
+
+// Static import would initialize deprecated compat registries on current Pi;
+// OMP rewrites this literal dynamic import to its native pi-ai module.
+async function loadCompatCompletionFns(): Promise<ClassifierCompletionFallbacks> {
+  const { complete, completeSimple } = await import(
+    "@earendil-works/pi-ai/compat"
+  );
+  return {
+    rawComplete: complete as ClassifierCompletionFn,
+    simpleComplete: completeSimple as ClassifierCompletionFn,
+  };
+}
+
+/**
+ * Prefer the current runtime registry so extension-registered providers remain
+ * visible. Older Pi-family runtimes (including OMP 18) expose neither
+ * `complete` nor `getProvider`; lazily load the compat API they already use.
+ */
+export function createRegistryCompletionFns(
+  registry: RegistryCompletionApi,
+  fallbackLoader: ClassifierCompletionFallbackLoader =
+    loadCompatCompletionFns,
+): ClassifierCompletionFallbacks {
+  let fallbackPromise: Promise<ClassifierCompletionFallbacks> | undefined;
+  const rawComplete: ClassifierCompletionFn =
+    typeof registry.complete === "function"
+      ? (model, context, options) =>
+        registry.complete!.call(registry, model, context, options)
+      : async (model, context, options) =>
+        (await (fallbackPromise ??= fallbackLoader())).rawComplete(
+          model,
+          context,
+          options,
+        );
+  const simpleComplete: ClassifierCompletionFn =
+    typeof registry.getProvider === "function"
+      ? (model, context, options) =>
+        completeSimpleWithRegistry(registry, model, context, options)
+      : async (model, context, options) =>
+        (await (fallbackPromise ??= fallbackLoader())).simpleComplete(
+          model,
+          context,
+          options,
+        );
+  return { rawComplete, simpleComplete };
+}
+
 export type RetryOptions = {
   maxAttempts?: number;
   maxTokens?: number;
@@ -155,19 +218,67 @@ export type ClassifierCompletionPlan = {
   reasoningLevel?: Exclude<EffectiveClassifierReasoningLevel, "off">;
 };
 
+async function completeClassifierAttempt(
+  completeFn: ClassifierCompletionFn,
+  model: Model<any>,
+  prompt: Parameters<ClassifierCompletionFn>[1],
+  parentSignal: AbortSignal | undefined,
+  options: Omit<Parameters<ClassifierCompletionFn>[2], "signal">,
+): Promise<AssistantMessage> {
+  if (options.timeoutMs === undefined) {
+    return completeFn(model, prompt, {
+      ...options,
+      ...(parentSignal === undefined ? {} : { signal: parentSignal }),
+    });
+  }
+
+  const controller = new AbortController();
+  const onParentAbort = () => controller.abort(parentSignal?.reason);
+  if (parentSignal?.aborted) onParentAbort();
+  else parentSignal?.addEventListener("abort", onParentAbort, { once: true });
+
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    onAbort = () => {
+      const reason = controller.signal.reason;
+      reject(reason instanceof Error ? reason : new Error("Classifier request aborted."));
+    };
+    if (controller.signal.aborted) onAbort();
+    else controller.signal.addEventListener("abort", onAbort, { once: true });
+  });
+  const timer = setTimeout(() => {
+    controller.abort(
+      new Error(`Classifier request timed out after ${options.timeoutMs} ms.`),
+    );
+  }, options.timeoutMs);
+
+  try {
+    return await Promise.race([
+      completeFn(model, prompt, {
+        ...options,
+        signal: controller.signal,
+      }),
+      aborted,
+    ]);
+  } finally {
+    clearTimeout(timer);
+    if (onAbort) controller.signal.removeEventListener("abort", onAbort);
+    parentSignal?.removeEventListener("abort", onParentAbort);
+  }
+}
+
 /**
  * Run normalized Pi AI completion through the provider in Pi's runtime registry.
- * This temporary bridge is only valid until Pi exposes
- * `ctx.modelRegistry.completeSimple(...)` natively. Replace this function with
- * that API when the project's minimum supported Pi version includes it.
+ * Callers use this only when the registry exposes `getProvider`; legacy
+ * registries take the compat completion path instead.
  */
 async function completeSimpleWithRegistry(
-  ctx: ExtensionContext,
+  registry: RegistryCompletionApi,
   model: Model<any>,
   context: { systemPrompt: string; messages: UserMessage[] },
   options: Parameters<ClassifierCompletionFn>[2],
 ): Promise<AssistantMessage> {
-  const provider = ctx.modelRegistry.getProvider(model.provider);
+  const provider = registry.getProvider?.(model.provider);
   if (!provider) throw new Error(`Unknown provider: ${model.provider}`);
   return provider.streamSimple(model, context, options).result();
 }
@@ -435,14 +546,15 @@ export async function classifyWithRetry(
     const started = Date.now();
     let response: AssistantMessage;
     try {
-      response = await completeFn(
+      response = await completeClassifierAttempt(
+        completeFn,
         classifier.model,
         prompt,
+        signal,
         {
           apiKey: classifier.apiKey,
           headers: classifier.headers,
           env: classifier.env,
-          signal,
           maxTokens,
           ...(temperature === undefined ? {} : { temperature }),
           ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
@@ -505,7 +617,8 @@ export async function classifyInStages(
   const fastStarted = Date.now();
   let fastResponse: AssistantMessage;
   try {
-    fastResponse = await completeFn(
+    fastResponse = await completeClassifierAttempt(
+      completeFn,
       classifier.model,
       {
         systemPrompt: prompt.systemPrompt,
@@ -515,11 +628,11 @@ export async function classifyInStages(
           stageMessage(CLASSIFIER_FAST_INSTRUCTION),
         ],
       },
+      signal,
       {
         apiKey: classifier.apiKey,
         headers: classifier.headers,
         env: classifier.env,
-        signal,
         // Reasoning and OpenAI-compatible models may consume hidden reasoning,
         // control, and EOS tokens before emitting the required visible digit.
         maxTokens: options.fastClassifierMaxTokens ??

package/extensions/auto-mode/config.ts

@@ -22,6 +22,7 @@ import {
   DEFAULT_MAX_USER_TRANSCRIPT_TOKENS,
   DEFAULT_PROTECTED_PATHS,
   DEFAULT_SOFT_DENY,
+  MAX_CLASSIFIER_TIMEOUT_MS,
   PI_GLOBAL_SETTINGS,
   PI_LEGACY_GLOBAL_SETTINGS,
   PI_PROJECT_LOCAL_SETTINGS,
@@ -324,10 +325,11 @@ export function validateSettingsFile(
       if (
         hasOwn(autoMode, "classifierTimeoutMs") &&
         (!Number.isInteger(autoMode.classifierTimeoutMs) ||
-          (autoMode.classifierTimeoutMs as number) < 1000)
+          (autoMode.classifierTimeoutMs as number) < 1000 ||
+          (autoMode.classifierTimeoutMs as number) > MAX_CLASSIFIER_TIMEOUT_MS)
       ) {
         diagnostics.push(
-          `${source}: autoMode.classifierTimeoutMs must be an integer of at least 1000`,
+          `${source}: autoMode.classifierTimeoutMs must be an integer from 1000 through ${MAX_CLASSIFIER_TIMEOUT_MS}`,
         );
       }
       if (
@@ -591,7 +593,9 @@ function validFastClassifierBudget(value: unknown): value is number {
 }
 
 function validClassifierTimeout(value: unknown): value is number {
-  return Number.isInteger(value) && Number(value) >= 1000;
+  return Number.isInteger(value) &&
+    Number(value) >= 1000 &&
+    Number(value) <= MAX_CLASSIFIER_TIMEOUT_MS;
 }
 
 function applyAutoModeScalars(

package/extensions/auto-mode/constants.ts

@@ -61,6 +61,8 @@ export const DENIAL_HISTORY_LIMIT = 12;
 
 /** Per-request timeout for classifier completions (fast and detailed stages). */
 export const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20_000;
+/** Largest timeout that Node can represent without reducing it to 1 ms. */
+export const MAX_CLASSIFIER_TIMEOUT_MS = 2_147_483_647;
 
 /** Built-in trusted environment. Users extend this with `$defaults`. */
 export const DEFAULT_ENVIRONMENT = [

package/extensions/auto-mode/hard-deny.ts

@@ -1,4 +1,5 @@
 import { statSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import {
   analyzeBash,
@@ -77,9 +78,115 @@ function matchesPathRoot(path: string, root: string): boolean {
   return isSameExistingPath(path.slice(0, root.length), root);
 }
 
+/**
+ * Top-level directories whose deletion or wholesale modification is a
+ * system-wide event. Shared between candidate validation and path
+ * classification; do not inline copies.
+ */
+const SYSTEM_ROOTS: ReadonlyArray<string> = [
+  "/bin",
+  "/boot",
+  "/dev",
+  "/etc",
+  "/home",
+  "/lib",
+  "/lib64",
+  "/Library",
+  "/private",
+  "/proc",
+  "/root",
+  "/run",
+  "/sbin",
+  "/sys",
+  "/System",
+  "/usr",
+  "/var",
+];
+
+/**
+ * Normalize a proposed temp-root value into a comparable absolute path.
+ * Returns undefined for values that cannot denote a subdirectory: the
+ * empty string, `/`, and slash-only artifacts.
+ */
+function normalizeRootCandidate(value: string): string | undefined {
+  const stripped = value.replace(/\/+$/, "");
+  // An empty stripped value must not fall through to `resolve()`, which
+  // would silently turn `/` into the process working directory.
+  if (!stripped) return undefined;
+  const normalized = resolve(stripped);
+  if (normalized === "/") return undefined;
+  return normalized;
+}
+
+/**
+ * True when a candidate temp root would weaken the deterministic deny tiers:
+ * it aliases (exact, case-folded, or dev/inode) `HOME`, `/`, or any system
+ * root, or it is a proper ancestor of the canonical home directory.
+ *
+ * Dev/inode identity covers symlinked spellings of existing directories;
+ * string comparison alone handles candidates that do not exist yet. See
+ * issue #31: without these guards, `TMPDIR=/` reduced every absolute path
+ * below an empty-string prefix match, and `TMPDIR=/private` made
+ * `/private/etc/**` disposable.
+ */
+function conflictsWithProtectedRoots(candidate: string, home: string): boolean {
+  if (candidate === "/") return true;
+  for (const protectedRoot of ["/", home, ...SYSTEM_ROOTS]) {
+    const canonical = resolve(protectedRoot);
+    if (
+      candidate === canonical ||
+      candidate.toLowerCase() === canonical.toLowerCase()
+    ) {
+      return true;
+    }
+    if (isSameExistingPath(candidate, canonical)) return true;
+  }
+  const homeCanonical = resolvePathForPolicy(home) ?? resolve(home);
+  return homeCanonical.toLowerCase().startsWith(`${candidate.toLowerCase()}/`);
+}
+
+let cachedTempRoots: ReadonlyArray<string> | undefined;
+let cachedTmpdirValue: string | undefined;
+
+/**
+ * Validated launcher-declared temp-dir roots whose subtrees are treated as
+ * disposable by `isRootHomeOrSystemPath`: the platform tmpdir, plus `/tmp` on
+ * macOS where it exists independently of `os.tmpdir()`. Each root appears in
+ * canonical and resolved spelling because callers pass symlink-resolved
+ * policy paths (`/tmp` → `/private/tmp` on macOS) and unresolved fallbacks
+ * alike. Values from `os.tmpdir()` are not trusted blindly; see
+ * `conflictsWithProtectedRoots`. The roots themselves are never exempt:
+ * deleting one is a system-wide delete.
+ *
+ * The memoization keys on the effective `os.tmpdir()` return value so tests
+ * can mutate `TMPDIR`, `TMP`, or `TEMP` between calls.
+ */
+export function tempRootCandidates(): ReadonlyArray<string> {
+  const currentTmpdir = tmpdir();
+  if (cachedTempRoots && cachedTmpdirValue === currentTmpdir) {
+    return cachedTempRoots;
+  }
+  cachedTmpdirValue = currentTmpdir;
+  cachedTempRoots = (() => {
+    const roots = new Set<string>();
+    const consider = (value: string) => {
+      const candidate = normalizeRootCandidate(value);
+      if (!candidate || conflictsWithProtectedRoots(candidate, HOME)) return;
+      roots.add(candidate);
+      const resolved = resolvePathForPolicy(candidate);
+      if (resolved) roots.add(resolved);
+    };
+    consider(currentTmpdir);
+    if (process.platform === "darwin") consider("/tmp");
+    return [...roots];
+  })();
+  return cachedTempRoots;
+}
+
 /**
  * True for `/`, the user's home root, or a top-level system root such as
- * `/etc`, `/usr`, or `/var`. Excludes the home *subtree*.
+ * `/etc`, `/usr`, or `/var`. Excludes the home *subtree* and the subtrees of
+ * platform temp directories (`os.tmpdir()` and `/tmp` on macOS).
  *
  * On some distros (e.g. Fedora Silverblue) HOME lives under `/var`, which is
  * in `systemRoots`. Without the subtree exemption, `path.startsWith("/var/")`
@@ -87,32 +194,36 @@ function matchesPathRoot(path: string, root: string): boolean {
  * `rm -rf ~/...`. HOME itself is still matched below, so `rm -rf ~` stays
  * blocked. `home` is a parameter so this can be unit-tested with a synthetic
  * `/var/home/...` value.
+ *
+ * The temp exemption mirrors the home one and covers cleanup of directories
+ * created with `mktemp`, `os.tmpdir()`, or plain `/tmp` paths. On macOS these
+ * resolve into `/private/tmp` or `/private/var/folders`, which used to match
+ * the `/private` system root and hard-deny every temp cleanup. Deleting a
+ * temp root itself still returns true; `tempRoots` is injectable for tests.
+ *
+ * Protection order matters (issue #31): exact `/`, the exact home root, and
+ * system roots win over every exemption. Injected `tempRoots` values are
+ * validated per call so hostile or malformed candidates cannot weaken the
+ * deterministic tiers.
  */
-export function isRootHomeOrSystemPath(path: string, home: string): boolean {
-  const systemRoots = [
-    "/bin",
-    "/boot",
-    "/dev",
-    "/etc",
-    "/home",
-    "/lib",
-    "/lib64",
-    "/Library",
-    "/private",
-    "/proc",
-    "/root",
-    "/run",
-    "/sbin",
-    "/sys",
-    "/System",
-    "/usr",
-    "/var",
-  ];
+export function isRootHomeOrSystemPath(
+  path: string,
+  home: string,
+  tempRoots: ReadonlyArray<string> = tempRootCandidates(),
+): boolean {
+  if (path === "/") return true;
+  if (path === home || isSameExistingPath(path, home)) return true;
   if (matchesPathRoot(path, home) && path.length > home.length) return false;
+  for (const root of tempRoots) {
+    const candidate = normalizeRootCandidate(root);
+    if (!candidate || conflictsWithProtectedRoots(candidate, home)) continue;
+    if (!matchesPathRoot(path, candidate)) continue;
+    // Subtree: disposable. Exact match: the temp root stays protected.
+    return path.length > candidate.length ? false : true;
+  }
   return (
-    path === "/" ||
     matchesPathRoot(path, home) ||
-    systemRoots.some((root) => matchesPathRoot(path, root))
+    SYSTEM_ROOTS.some((root) => matchesPathRoot(path, root))
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@czottmann/pi-automode",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Claude Code-style auto mode guardrail for pi.",
   "repository": {
     "url": "https://github.com/czottmann/pi-automode"